Multi-factor authentication (MFA) is an effective way to reduce account compromise, yet adoption and implementation remain inconsistent across organizations.
Attackers can use stolen credentials to access corporate accounts without exploiting software vulnerabilities. Research on identity-based attacks reinforces the need for MFA to protect accounts when passwords are compromised.
However, selecting the right MFA method introduces additional challenges. Security teams need to balance protection against real-world attacks with usability and ensure authentication requirements are consistently enforced.
The problem with passwords
Passwords remain one of the most common authentication methods and a frequent target for attackers. Human behavior continues to undermine their effectiveness, particularly when users reuse credentials across multiple accounts. This makes credential-stuffing attacks more effective.
Attackers often don't need to crack passwords because they can obtain them through information-stealing malware or phishing campaigns. Third-party breaches provide another source of compromised credentials that attackers can use against corporate applications.
Dormant accounts and legacy applications without additional authentication controls can further increase exposure.
Why MFA still matters
MFA adds another layer of protection when passwords are compromised. Microsoft research demonstrates its effectiveness in reducing account compromise, even when attackers obtain valid credentials.
However, MFA adoption remains inconsistent. Some organizations protect only certain applications or users, leaving authentication gaps attackers can exploit.
MFA fundamentals
The National Institute of Standards and Technology (NIST) identifies three primary authentication factors. Organizations typically combine factors to strengthen account security, although each introduces different operational challenges.
Something you know
Knowledge-based authentication uses information a person remembers, such as a password or PIN. These methods are inexpensive and widely supported but remain vulnerable to credential theft.
Combining two passwords does not constitute MFA because both use the same authentication factor.
Something you have
Possession-based authentication requires users to control a device or credential, such as a hardware security key or authenticator application.
The level of protection varies by method. One-time passwords remain vulnerable to phishing, while FIDO2 security keys offer stronger protection against these attacks.
Lost or stolen devices can complicate account recovery, while managing physical authenticators across large organizations can increase administrative costs.
Something you are
Biometric authentication uses physical characteristics, such as fingerprints or facial recognition, to verify identity. These methods simplify authentication but can produce recognition failures due to physical injuries or environmental conditions.
Under NIST SP 800-63B-4, biometrics cannot serve as a standalone authentication method. Instead, they must be combined with a physical authenticator. For example, a fingerprint can verify a user's identity locally before their device uses a passkey to authenticate them to an application.
Somewhere you are
Location is not one of NIST's three authentication factors, but organizations can use geographic or network information to assess login risk.
Location-based signals can support conditional access policies by triggering additional verification when authentication attempts originate from unusual locations.
However, VPNs and proxies can obscure an attacker's location. Legitimate travel may also trigger false alerts, making location more useful for identifying suspicious login activity than verifying a user's identity.
MFA methods compared: Advantages and weaknesses
MFA methods offer different levels of protection against account compromise. Organizations must also consider how easily each method can be deployed and managed.
SMS authentication is widely accessible and requires no additional app, but attackers can obtain verification codes through SIM swapping or by tricking users into revealing them via phishing.
Email verification is convenient but provides limited protection if attackers gain access to the user's email account. They may be able to intercept verification codes and complete unauthorized logins. Email verification also may not qualify as true MFA if it does not provide an independent authentication factor.
Authenticator apps generate time-based one-time passwords (TOTP) without relying on cellular networks. This avoids SIM-swapping risks, although attackers can still capture codes through real-time phishing.
Push notifications simplify authentication by allowing users to approve login requests on their devices. However, attackers can exploit repeated prompts through MFA fatigue attacks. Number matching reduces accidental approvals but does not make push authentication phishing-resistant.
FIDO2 security keys use public-key cryptography to provide phishing-resistant authentication. They offer strong protection for privileged accounts, although purchasing and distributing physical devices can increase administrative costs.
Passkeys provide similar phishing-resistant protection without necessarily requiring a separate hardware key. Device-bound passkeys keep credentials on a specific authenticator, while synchronized passkeys allow access across supported devices. Organizations should evaluate credential recovery procedures and platform compatibility before deployment.
Smart cards, including Personal Identity Verification (PIV) credentials, use certificate-based authentication and are often used in managed enterprise environments. However, they require supporting infrastructure and ongoing credential management.
How attackers bypass MFA
Attackers often bypass MFA by exploiting weaknesses in authentication workflows rather than defeating the underlying authentication technology.
MFA fatigue and push notification abuse
MFA fatigue attacks occur when attackers use stolen credentials to generate repeated authentication requests. The goal is to pressure or confuse users into approving an unauthorized login.
Number matching reduces accidental approvals by requiring users to enter a displayed number rather than simply accepting a notification. Organizations can further limit exposure by restricting repeated authentication attempts and investigating unusual push activity.
Adversary-in-the-middle (AitM)
Adversary-in-the-middle (AitM) attacks use attacker-controlled infrastructure to relay authentication requests between users and legitimate services.
Victims may enter their credentials and complete MFA challenges through fraudulent login pages, allowing attackers to capture authenticated session cookies.
Phishing-resistant protocols such as WebAuthn reduce this risk by binding authentication to the legitimate service's domain.
Session hijacking and token theft
AitM can lead to session hijacking, but attackers can also steal session cookies or authentication tokens through information-stealing malware or application vulnerabilities. They can then use this stolen session material to impersonate authenticated users.
Because attackers exploit an established session, they may gain access without completing another MFA challenge, even when phishing-resistant authentication is enabled.
Organizations should monitor suspicious session activity and apply token protection controls where supported.
Help desk and account recovery attacks
Threat actors may impersonate employees and contact technical support to request an MFA reset. Weak identity verification procedures can allow attackers to register their own authentication devices.
Once an unauthorized authenticator is enrolled, attackers may gain access using otherwise legitimate authentication workflows.
Organizations should verify user identities before resetting MFA. Any changes to registered authentication devices should also trigger security alerts and additional review.
MFA downgrade and fallback abuse
Some applications allow weaker authentication methods when stronger options are unavailable. For example, an organization may require FIDO2 security keys for routine access but permit SMS verification during account recovery.
Attackers who exploit these fallback procedures can potentially bypass the stronger authentication requirement.
Security teams should ensure that recovery methods provide protection appropriate to the sensitivity of the accounts involved.
The shift toward phishing-resistant MFA
While stronger recovery procedures help close authentication gaps, organizations also need MFA methods that are resistant to phishing attacks.
NIST SP 800-63B-4 recognizes cryptographic authentication methods, such as WebAuthn, that bind authentication to the legitimate service through public-key cryptography. The private key remains with the authenticator, while the service verifies the response using the corresponding public key.
This makes FIDO2 security keys and passkeys more resistant to phishing than traditional MFA methods. However, attackers can still compromise endpoints or hijack authenticated sessions.
How organizations can strengthen MFA protection
Security teams should prioritize the following practices to reduce authentication risks:
- Prioritize phishing-resistant MFA. Deploy FIDO2 security keys or passkeys for privileged accounts and sensitive applications.
- Close authentication gaps. Identify accounts and applications without MFA, including legacy systems.
- Secure account recovery. Verify user identities before resetting MFA or registering new authenticators.
- Protect authenticated sessions. Monitor suspicious session activity and enforce risk-based session expiration policies.
- Restrict weaker fallback methods. Prevent less secure options from bypassing stronger authentication requirements.
- Monitor authentication changes. Investigate unusual login patterns and unauthorized authenticator registrations.
- Train employees. Teach users to recognize unexpected MFA prompts and report suspicious recovery requests.
These practices help organizations strengthen MFA protection while addressing the weaknesses attackers continue to exploit.
Bottom line
MFA remains an effective defense against account compromise, but its effectiveness depends on the methods organizations choose and how they implement them. Security leaders should treat MFA as an important part of their identity security strategy rather than a complete solution to identity-based threats.
For additional guidance, learn how to strengthen identity and access management with zero trust.